Monday, 21 April 2014

Search history on windows 8.1 - Part 2

I have recently blogged about windows 8.1 search history and how searched terms/phrases are recorded as LNK files in a post here. But windows also logs searched terms (search history) to the event log and web history (and cache).

From the LNK files, we know the first time a term was searched for, but not the next time or the last time it was searched, which is usually more relevant from an investigation perspective. However, this information can be obtained from the Connected-Search event log file. On disk it would be under:
 \Windows\System32\Winevt\Logs\Microsoft-Windows-Connected-Search%4Operational.evtx

Under Event viewer, you can find it under:
 \Applications and Services Logs\Microsoft\Windows\Connected-Search\Operational

Below is a screenshot for one such log entry.

Searched keyword is 'enscript' and machine was online when search was run

Windows logs all URLs and reference links here. Windows, by default tries to search for everything online as well as on the machine. Even if you are offline, a search URL for online searches is generated and seen here. The screenshot below shows the same search run when machine was offline (not connected to internet).

Searching for 'enscript' when machine is offline

Each time a search is run, an entry is created, sometimes multiple entries (this probably has to do with different views when browsing the search results). For searches (if machine was online), the URL requests and responses are also found in the IE web history and cache database (WebcacheV01.dat). The database is located at
\Users\<USER>\AppData\Local\Microsoft\Windows\WebCache\

The best way to study this data would be by parsing this database either manually (using libesedb and lots of data formatting with additional parsing!) or use a free program like IE10 History reader (or an expensive brand forensic tool). However, if you are just interested in the search terms without dates or other information, a raw search into the datebase files will suffice.

To find searched terms, you will need to search  for URLs beginning with
 https://www.windowssearch.com/search?q=

The screenshot below shows hits when searching the IE web cache files for the above URL using Encase.
Search hits in IE web cache database as seen in encase

Search as you type

An aspect missing from LNK files and the event logs is the search suggestions and interim search results. As Rob Lee hinted to me earlier that a user could search for a term (without hitting Enter or the search button after entering the term in the search box), but not click on any results and none of the above artifacts would be created. Windows uses the 'search as you type' feature and  terms windows guessed for you (as you were typing into the search box) or interim search results are discarded. However you would find some traces of the terms as windows will make online queries for the 'search as you type' feature. If this is not clear, just recall how you search with google. As you begin typing the letters of your keyword into the search box, google automatically suggests most popular searches beginning with those letters. Windows also does the same thing.

Google's search as you type feature

To find such searches which were discarded, search for URLs beginning with
  https://www.windowssearch.com/suggestions?q=

Actually, these are not the suggestions, but the lookups for term/phrase entered into the search box. The data returned (query response) will contain the suggestions.

Below is a screenshot showing the webcacheV01.dat file (and supporting db files) with search hits as displayed in Encase.

Search hits showing Windows querying for popular search term suggestions based on user entered input

Thus there are multiple locations (connected search LNK files, event logs, web cache) where an investigator can find evidence of searches run by a user. Each has its uses and caveats.


13 comments:

  1. U.S. Open, but is instead concentrating on her performance this week in Stanford.
    "So much was put on the decision of the wild card of the French Open, and it didn’t work out,
    " she told local press following her first-round win at the WTA event. "It’s not something that I’m focusing on."
    US Open Tennis Live
    US Open Tennis 2017 Live
    US Open Live
    US Open 2017 Live
    The five-time Grand Slam champion is ranked No. 171, and would require a wild
    card to get into the main draw at the U.S. Open. She would otherwise get into the qualifying event.
    US Open Tennis Live Stream
    US Open Live Stream
    US Open Tennis 2017 Live Stream
    US Open 2017 live Stream
    US Open Tennis 2017
    US Open 2017
    Sharapova was refused a wild card for the French Open amidst huge publicity as she returned from a
    15-month suspension for testing positive for meldonium. She decided not to request a wild card for Wimbledon,
    amid suggestions that the tournament was leaning against giving it to her,
    and eventually did not play during the grass-court season because of injury

    ReplyDelete
  2. U.S. Open, but is instead concentrating on her performance this week in Stanford.
    "So much was put on the decision of the wild card of the French Open, and it didn’t work out,
    " she told local press following her first-round win at the WTA event. "It’s not something that I’m focusing on."
    US Open Tennis Live
    US Open Tennis 2017 Live
    US Open Live
    US Open 2017 Live
    The five-time Grand Slam champion is ranked No. 171, and would require a wild
    card to get into the main draw at the U.S. Open. She would otherwise get into the qualifying event.
    US Open Tennis Live Stream
    US Open Live Stream
    US Open Tennis 2017 Live Stream
    US Open 2017 live Stream
    US Open Tennis 2017
    US Open 2017
    Sharapova was refused a wild card for the French Open amidst huge publicity as she returned from a
    15-month suspension for testing positive for meldonium. She decided not to request a wild card for Wimbledon,
    amid suggestions that the tournament was leaning against giving it to her,
    and eventually did not play during the grass-court season because of injury

    ReplyDelete
  3. The Wallabies must successfully target dynamic All Blacks second rowers Brodie Retallick and
    Sam Whitelock when they attempt to turn their Bledisloe Cup fortunes around, says Australian backrower
    Rory Arnold.The formidable duo of Retallick and Whitelock has been one of the great strengths of the world
    champion All Blacks’ forward ­machine in recent years and both are used to winning against the Wallabies.
    All Blacks vs Wallabies
    All Blacks vs Wallabies Live
    All Blacks vs Wallabies Stream

    Whitelock has tasted defeat just three times in 20 games Tests against Australia and Retallick once in 15.
    Rising Wallabies lock Rory ­Arnold said getting an edge over the duo was key for his team.“They’ve been world-class
    locks now for a number of years, so if we want to dominate up front we know we’ve got to go at those blokes,” said Arnold.
    “We’re going to have to be at our best, the second-rowers, to take those blokes on.”
    Watch All Blacks vs Wallabies
    Watch All Blacks vs Wallabies Live
    Wallabies vs All Blacks

    While Whitelock and Retallick have been a constant force for New Zealand,
    Australia have chopped and changed their second-row combinations since the 2015 World Cup final against the All Blacks.

    ReplyDelete
  4. The Wallabies must successfully target dynamic All Blacks second rowers Brodie Retallick and
    Sam Whitelock when they attempt to turn their Bledisloe Cup fortunes around, says Australian backrower
    Rory Arnold.The formidable duo of Retallick and Whitelock has been one of the great strengths of the world
    champion All Blacks’ forward ­machine in recent years and both are used to winning against the Wallabies.
    All Blacks vs Wallabies
    All Blacks vs Wallabies Live
    All Blacks vs Wallabies Stream

    Whitelock has tasted defeat just three times in 20 games Tests against Australia and Retallick once in 15.
    Rising Wallabies lock Rory ­Arnold said getting an edge over the duo was key for his team.“They’ve been world-class
    locks now for a number of years, so if we want to dominate up front we know we’ve got to go at those blokes,” said Arnold.
    “We’re going to have to be at our best, the second-rowers, to take those blokes on.”
    Watch All Blacks vs Wallabies
    Watch All Blacks vs Wallabies Live
    Wallabies vs All Blacks

    While Whitelock and Retallick have been a constant force for New Zealand,
    Australia have chopped and changed their second-row combinations since the 2015 World Cup final against the All Blacks.

    ReplyDelete
  5. The long ushered super fight that fans dared Golden Boy promoter,
    Oscar De Le Hoya, to make, finally got the go ahead when it was officially announced in May of this year.
    Canelo Alvarez versus Gennady Golovkin is set for the 26th of September at the T-Mobile Arena, Las Vegas.
    Mayweather vs Mcgregor
    Mayweather vs Mcgregor Live
    Mayweather vs Mcgregor Live Online
    Mayweather vs Mcgregor Live Stream

    ReplyDelete